spring-projects/spring-security · error · RuntimeException

Exception occurred while looking up groups for user

Error message

Exception occurred while looking up groups for user

What it means

DefaultWASUsernameAndGroupsExtractor.getWebSphereGroups performs a JNDI lookup against the WebSphere user registry to resolve group memberships for a security name. Any failure during the LDAP/JNDI query (communication failure, bad principal, registry unavailable, naming exception) is caught and rethrown as an unchecked RuntimeException wrapping the original exception. The library throws this because group lookup is considered essential to WebSphere pre-authentication and cannot silently return empty groups.

Source

Thrown at web/src/main/java/org/springframework/security/web/authentication/preauth/websphere/DefaultWASUsernameAndGroupsExtractor.java:137

	@SuppressWarnings("unchecked")
	private static List<String> getWebSphereGroups(final @Nullable String securityName) {
		Context context = null;
		try {
			// TODO: Cache UserRegistry object
			context = new InitialContext();
			Object objRef = context.lookup(USER_REGISTRY);
			Object userReg = invokeMethod(getNarrowMethod(), null, objRef,
					Class.forName("com.ibm.websphere.security.UserRegistry"));
			logger.debug(LogMessage.format("Determining WebSphere groups for user %s using WebSphere UserRegistry %s",
					securityName, userReg));
			final Collection<String> groups = (Collection<String>) invokeMethod(getGroupsForUserMethod(), userReg,
					new Object[] { securityName });
			logger.debug(LogMessage.format("Groups for user %s: %s", securityName, groups));
			return new ArrayList<>(groups);
		}
		catch (Exception ex) {
			logger.error("Exception occurred while looking up groups for user", ex);
			throw new RuntimeException("Exception occurred while looking up groups for user", ex);
		}
		finally {
			closeContext(context);
		}
	}

	private static void closeContext(@Nullable Context context) {
		try {
			if (context != null) {
				context.close();
			}
		}
		catch (NamingException ex) {
			logger.debug("Exception occurred while closing context", ex);
		}
	}

	private static Object invokeMethod(Method method, @Nullable Object instance, Object... args) {

View on GitHub (pinned to 96852e8860)

Solutions

  1. Verify the WebSphere global security user registry (LDAP) is reachable: check host/port and test with the wsadmin or admin console 'Test connection'.
  2. Check that the securityName passed to getWebSphereGroups actually exists in the registry.
  3. Inspect the wrapped cause (ex.getCause()) in the stack trace for the real JNDI/naming error (e.g. CommunicationException, NameNotFoundException).
  4. Confirm the application is running inside WebSphere/WAS with proper JAAS subject and JNDI environment; running on plain Tomcat will not work.
  5. Increase logging (logger.error already logs the cause) and fix the underlying registry configuration in WAS admin console.
  6. If groups are optional, catch the RuntimeException around the pre-auth call and degrade gracefully instead of failing the request.

Example fix

// before
List<String> groups = extractor.getWebSphereGroups(securityName);
// after
List<String> groups;
try {
    groups = extractor.getWebSphereGroups(securityName);
} catch (RuntimeException ex) {
    logger.warn("Group lookup failed for " + securityName + ": " + ex.getCause());
    groups = Collections.emptyList();
}
Defensive patterns

Strategy: try-catch

Validate before calling

// validate user exists in registry before group lookup
if (securityName == null || securityName.isBlank()) {
    throw new IllegalArgumentException("securityName is required");
}

Try / catch

try {
    List<String> groups = extractor.getWebSphereGroups(securityName);
} catch (RuntimeException ex) {
    logger.error("Group lookup failed, cause: " + ex.getCause(), ex);
    groups = Collections.emptyList(); // or deny access
}

Prevention

When it happens

Trigger: Calling getWebSphereGroups(securityName) when the configured WebSphere user registry is unreachable, the JNDI context settings are wrong, the securityName does not exist in the registry, or any underlying naming/communication exception occurs during groupsForUser invocation.

Common situations: WebSphere admin console user registry misconfiguration; LDAP server down or firewall blocking the directory port; running outside a WebSphere container where WAS JNDI properties are absent; user was deleted from LDAP after authentication; typo in the security name passed by the pre-auth filter.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/205263fb87f95554. Report an issue: GitHub.